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IN THE CLAIMS: 
Amended claims follow: 

1. (Currently Amended) A method for preventing needless rescanning of 
objects comprising: 

verifying an integrity of a file system by scanning the file system resulting 
in at least one known scanned region; 

creating a database of the known scanned regions of the verified file 
system; and 

validating an integrity of an object in the file system against the database 
of known scanned regions; 

wherein the verifying comprises: 

receiving a file system event from a real-time monitoring system, the file 
system event indicating that an object in the file system has been accessed; and 

flagging the database of known scanned regions to indicate which of the 
known scanned regions was occupied by the accessed object; 

wherein the validating utilizes the flagging; 

whefein the database of known smarmed regions comprises a copy of a 
partition table data structure indicating an identity and a location of a known 
scanned region occupied bv the object: 

wherein the partition table data structure includes an inode that contains 
information about the object other than name, and a directory block that contains 
the object name and a number of the inode of the object; 
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wherein flagging comprises indicating whic h of the modes and directory 
blocks were occupied bv the accessed object 

2. (Original) The method of claim 1, wherein verifying the integrity of the file 
system comprises scanning the objects in the file system for a presence of viruses. 

3. (Cancelled) 

4. (Cancelled) 

5. (Cancelled) 

6. (Cancelled) 

7. (Currently Amended) The method of claim [6]L wherein the partition table 
data structure includes a super block that contains information about the file 
system as a whole, and a data block that contains a location in the file system 
where the object is stored, 

8. (Original) The method of claim 7, wherein validating the integrity of an object 
comprises determining that the object does not occupy a flagged known scanned 
region. 
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9. (Cancelled) 

10. (Currently Amended) The method of claim [5>]1, wherein validating the 
integrity of an object comprises determining that the object does not occupy a 
flagged inode and directory block. 

1 1. (Original) The method of claim 1 further comprising: 

rescanning the object -when the integrity of the object has not been 
validated; and 

bypassing rescanning the object when the integrity of the object has been 
validated. 

12. (Currently Amended) The method of claim 1 5 wherein the real-time 
monitoring system is a virtual device driver (V xD) program. 

13. (Previously Presented) The method of claim 1 , wherein the real-time 
monitoring system is a UNIX daemon. 

14. (Previously Presented) The method of claim 1, wherein the real-time 
monitoring system is a network loadable module. 

15. (Currently Amended) An apparatus comprising: 

a machine-accessible medium having stored thereon executable 
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instructions to cause a computer to perform: 

verifying an integrity of a file system hy scanning the file system resulting 
in at least one known scanned region; 

creating a database of known scanned regions of the verified file system; 

and 

validating the integrity of an object in the file system against the 
database of known scanned regions; 

wherein the verifying comprises: 

receiving a file system event from a real-time monitoring system, the file 
system event indicating that an object in the file system has been accessed; and 

flagging the database of known scanned regions to indicate which of the 
known scanned regions was occupied by the accessed object; 

wherein the validating utilizes the flagging; 

wherein the database of known scanned regions comprises a copy of a 
partition table data structure indicating an identity and a location of the known 
scanned reeion occupied bv the object: 

wherein the partition table data structure includes at least one of an inode 
that contains information about the ob ject other than name, and a directory block 
fW Mwtams the object name and a numb er of the inode of the object: 

wherein flagging co m prises indicating which of the in odes or directory 
blocks were occupied by the accessed object . 

16. (Original) The apparatus of claim 15, wherein verifying the integrity of the 
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file system comprises scanning every object in the file system for the presence of 
viruses. 

17. (Cancelled) 

18. (Cancelled) 

19. (Cancelled) 

20. (Cancelled) 

21 . (Currently Amended) The apparatus of claim 1 [9] 5, wherein the partition 
table data structure includes a super block that contains information about the file 
system as a whole, and a data block that contains a location in the file system 
where the object is stored. 

22. (Original) The apparatus of claim 15, wherein validating the integrity of an 
object comprises determining that the object does not occupy a flagged region. 

23. (Cancelled) 

24. (Currently Amended) The apparatus of claim [20115, wherein the instructions 
for validating the integrity of an object comprises determining that the object does 
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not occupy a flagged inode and directory block. 
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25. (Original) The apparatus of claim 15 further comprising instructions to cause 
a computer to perform: 

rescanning the object when the integrity of the object has not been 
validated; and 

bypassing rescanning the object when the integrity of the object has been 
validated, 

26. (Currently Amended) The apparatus of claim 15, wherein the real-time 
monitoring system is a virtual device driver (V xD^program. 

27. (Previously Presented) The apparatus of claim 15, wherein the real-time 
monitoring system is a UNIX daemon. 

28. (Previously Presented) The apparatus of claim 15, wherein the real-time 
monitoring system is a network loadable module. 

29. (Currently Amended) An integrity validator comprising: 

a verifier to verify the integrity of a file system by scanning the file system 
resulting in at least one known scanned region; 

a database of the known scanned regions of the verified file system; and 
a validator to validate the integrity of an object in the file system against 
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the database of known scanned regions; 
wherein the verifying comprises: 

receiving a file system event from a real-time monitoring system, the file 
system event indicating that an object in the file system has been accessed; and 

flagging the database of known scanned regions to indicate which of the 
known scanned regions was occupied by the accessed object; 

wherein the validating utilizes the flagging; 

wherein the database of known scanned regions comprises a copy of a 
partition table data structure indicating an identity and a location of a known 
scanned region occupied by the object; 

wherein the partition table data structure includes an inode that contains 
information about the object other than name, and a directory block that contains 
the object name and a number of the inode of the object: 

wherein flagging comprises indicating which of the partition table data 
structures were occupied by the accessed object . 

30. (Original) The device of claim 29, wherein the verifier verifies the integrity of 
the file system by scanning the objects in the file system for the presence of 
viruses. 

31. (Cancelled) 

32. (Cancelled) 
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33. (Cancelled) 

34. (Cancelled) 

35. (Currently Amended) The device of claim [33]29, wherein the partition table 
data structure includes a super block that contains information about the file 
system as a whole, and a data block that contains a location in the file system 
where the object is stored, 

36. (Original) The device of claim 29, wherein the validator validates the 
integrity of an object by determining that the object does not occupy a flagged 
known scanned region. 

37. (Cancelled) 

38. (Currently Amended) The device of claim [34]29, wherein the validator 
validates the integrity of an object by determining that the object does not occupy 
a flagged partition table data structure. 

39. (Original) The device of claim 29, further comprising: 

an AV scanner to rescan the object when the integrity of the object has not 
been validated, wherein rescanning is bypassed when the integrity of the object 
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40. (Currently Amended) The device of claim 29, wherein the real-time 
monitoring system is a virtual device driver fVxD^Drogram. 

41. (Previously Presented) The device of claim 29, wherein the real-time 
monitoring system is a UNIX daemon. 

42. (Previously Presented) The device of claim 29, wherein the real-time 
monitoring system is a network loadable module. 

43. (Currently Amended) A computer system comprising: 

a processor coupled to a system bus; 

a memory coupled to the processor through the system bus; 

a machine-accessible medium coupled to the processor through the system 

bus; 

an integrity process executed from the machine-accessible medium by the 
processor, wherein the integrity process causes the processor to verify the 
integrity of a file system resulting in at least one known scanned region, to create 
a database of known scanned regions of the verified file system, and to validate 
the integrity of an object in the file system against the database of known scanned 
regions; 

wherein the verifying comprises; 
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receiving a file system event from a real-time monitoring system, the file system 
event indicating that an object in the file system has been accessed; and 

flagging the database of known scanned regions to indicate which of the 
known scanned regions was occupied by the accessed object; 

wherein the validating utilizes the flagging! 

wherein the database of kn ^wn graine d regions com prises a copy of a 
partition table data structure indicating an ide ntity and a location of a known 
scanned region occupied bv the object : 

wherein the partition table data structure includes an frode that contains 
information about the obiect other than name, and a directory block that contains 
the obj ect name and a number of the inode of the object; 

wherein the svstem causes the processor to flag t he database of known 
regions to indicate which of the modes and directory blocks were occupied by the 
accessed obiect . 

44. (Original) The computer system of claim 43, wherein the system causes the 
processor to verify the integrity of the file system by scanning the objects in the 
file system for the presence of viruses, 

45. (Cancelled) 

46. (Cancelled) 
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48. (Cancelled) 

49. (Currently Amended) The computer system of claim 4[7]3, wherein the 
partition table data structure includes a super block that contains information 
about the file system as a whole, and a data block that contains a location in the 
file system where the object is stored. 

50. (Original) The computer system of claim 43, wherein the system causes the 
processor to validate the integrity of an object by determining that the object does 
not occupy a flagged known scanned region. 

5 L (Cancelled) 

52. (Currently Amended) The computer system of claim 4[8]3, wherein the 
system causes the processor to validate the integrity of an object by determining 
that the object does not occupy a flagged inode and directory block. 

53. (Original) The computer system of claim 43, wherein the system further 
causes the processor to; 

rescan the object when the integrity of the object has not been validated; 

and 
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bypass the rescan of the object when the integrity of the object has been 
validated. 

54. (Currently Amended) The computer system of claim 43, wherein the real-time 
monitoring system is a virtual device driver f VxD^program. 

55. (Previously Presented) The computer system of claim 43, wherein the real- 
time monitoring system is a UNIX daemon. 

56. (Previously Presented) The computer system of claim 43, wherein the real- 
time monitoring system is a network loadable module. 
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